Closed fokkog closed 3 years ago
My bad for raising a duplicate issue. I did a Google search and found nothing, should have done a GitHub issue search.
We should var name = '<span>' + $.fn.dataTable.render.text().display(data) + '</span>'; //prevent against possible XSS
https://github.com/abpframework/abp/blob/0c89ff55a22f33b786b316851a9d60cfff66cd01/modules/identity/src/Volo.Abp.Identity.Web/Pages/Identity/Roles/index.js#L87
After doing some POC development with ABP Framework I am greatly impressed, finding it a tremendous productivity booster. One thing I did notice is that the DataTables grids I initially ended up with show unencoded data. This is visible in the starter template, by entering this role name:
<script>alert('xss');</script>
This is also visible in the tutorial results, by entering this value as a book name. In both cases the JavaScript gets executed and the alert gets displayed.One way to prevent this is to add a render function for data columns (see also https://datatables.net/manual/data/renderers#Text-helper):
render: $.fn.dataTable.render.text()
Version: 4.2.2 User interface: MVC / Razor Pages Database provider: n/a Exception message/stack trace: n/a